Can't parse @timestamp


(Sergey Murashov) #1

I get netflow data and I need replace @timestamp to correct.
I use this:
ruby {
code => 'event.set("temp", Time.now)'
}
date {
match => [ "temp", "ISO8601" ]
target => "@timestamp"
timezone => "Europe/Moscow"
}
In rubydebug i see [0] "_dateparsefailure" but @timestamp from netflow look like 2010-04-13T06:54:25.000Z. This is ISO8601.
I try to use match => [ "temp", "yyyy-MM-dd'T'HH:mm:ss.SSS" ]. Not work.
Where is my mistake?


#2

It should be "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.